Audit native transports and retain secure export diagnostics

docs/electron-best-practices.md

@@ -84,9 +84,55 @@ that the whole application is clean, fully optimized or independently audited.
 
 ## Latest reproducible checks
 
-- Full source suite: 749 tests passed, no failures or skips; see the ignored
-  `artifacts/mvp-final-startup-suite.log`. `npm run lint` passed again with
-  zero warnings on 2026-10-13.
+A subsequent full run after the Established-alarm regression added a test
+passed 764 of765 and exposed a real gateway cancellation race: the policy
+monitor aborted the provider but discarded its fixed409 error, producing500.
+The gateway now preserves the first fixed cancellation reason (policy409,
+caller403, deadline504). Fourteen focused tests and scoped lint passed. Actual
+collector trace `3b6b5e374da506f7ae5ffbb118933bf6` shows the provider aborted at
+101.6ms under the gateway and library parents. The earlier failed full run is
+retained in `artifacts/transport-owner-containment-final-suite.log`.
+
+The subsequent native clipboard/upload scenario passed all17 enforcement
+checks but failed diagnostics acceptance because lifetime exports recorded two
+errors. Collector rejected writes remained0; their exact causes cannot be
+reconstructed from the original counters. Failure instrumentation and a fresh
+acceptance run must resolve this separately from DLP transmission proof.
+
+The browser now retains at most32 cloned export-failure facts and lifetime
+totals by fixed reason. Facts include traces/logs, generation, duration, fixed
+HTTP status, retirement overlap and explicitly signalled cancellation. Raw
+error text, response bodies, credentials and collector URLs are excluded.
+Actual held HTTP exports prove that retirement cancellation remains counted
+as failure; the instrumentation does not silently reset or retry operations.
+Seventeen focused diagnostics tests passed, including timeout, refusal,503,
+bounded history and concurrent flush attribution.
+
+A fresh public-only native diagnostic run completed with four independently
+reviewed policy publications and four public HTTPS submissions. Every snapshot
+had zero current/lifetime failures and an empty failure history; actual exported
+trace `b5eefaf6bb8407f6917bd5cada6e8587` and collector rejectedWrites0 were
+verified. Reproduction: `node scripts/native-diagnostics-public.mjs` with the
+protected local collector already running. This does not retrospectively prove
+the cause of the earlier two failures or reset their historical evidence.
+
+A further quiet public-only native measurement delivered80 benign HTTPS
+responses across four reviewed publications: median59.53ms, p95 83.19ms,
+max88.17ms; observed main event-loop maximum drift328.29ms over637 samples.
+Current/lifetime failures remained0, collector rejectedWrites0. Trace
+`d4689e3d28ebe902b752500c0f79e30b` and
+`artifacts/public-backpressure-native-proof.json` are local evidence. This does
+not resolve or causally explain the semantic run's three timeouts and one
+concurrency failure. A bounded export queue, single-flight flush and collector
+commit-latency measurements are the next narrowly scoped diagnostics work;
+mandatory inspection and audit durability must remain intact.
+
+- Full source suite: 771 tests passed with `--test-concurrency=2`, no failures
+  or skips; see `artifacts/transport-owner-final-failure-ledger-suite.log`. An earlier
+  higher-concurrency run failed one evidence-key ACL check; its cause remains
+  unconfirmed and its log is retained. All 18 evidence tests passed separately.
+  No ACL protection or timeout was weakened. `npm run lint` passed with zero
+  warnings after the final source changes.
 - A fresh `npm audit --omit=dev --json` reported zero advisories. Development
   toolchain findings remain tracked separately in `dependency-audit.md`.
 - In the paired single module-load profiles, diagnostics require time changed
@@ -95,7 +141,11 @@ that the whole application is clean, fully optimized or independently audited.
   measurements do not establish full application startup or percentile gains.
 - Native Windows DLP fixtures delivered public data and blocked confidential
   literal and semantic payloads. Restart reused the protected device profile.
-  These are separate from final packaged-artifact acceptance.
+  These are separate from packaged-artifact acceptance. The final literal and
+  actual-restart fixtures pass17+5 checks with zero lifetime exports failed.
+  The latest semantic receiver/model checks pass, but diagnostics acceptance
+  fails on three measured2s timeouts and one concurrency rejection. These are
+  retained as real failures, not cancelled exports or successful delivery.
 - The protected local OpenTelemetry receiver reported zero rejected writes.
   Trace `33b46998b44c3179cccd2826d5790c00` correlates browser.request,
   browser.inspect.local, inspector.inspect, semantic load/inference and durable
@@ -111,6 +161,12 @@ that the whole application is clean, fully optimized or independently audited.
 - The full enrolled browser WebTransport receiver fixture now passes through
   reviewed DIRECT and fetched HTTPS PAC policies: zero managed packets/bytes,
   paired against 132 baseline bytes, with ordinary HTTPS submissions working.
-  It records source hashes and genuine operational traces. There is still no
-  per-attempt WebTransport security event because this path produces no
-  Electron webRequest callback; transport denial and audit coverage are separate.
+  It records source hashes and genuine operational traces. A fixed private
+  native channel now shares the existing clipboard debugger owner and records
+  six Created and six Closed security events across the tested window and
+  dedicated-worker attempts, with zero Established events. All twelve events
+  correlate with exported audit traces. No raw URL, payload or CDP identifier
+  enters these events. See [native transport observability](native-transport-observability.md)
+  for coverage limits, failure behavior and ECS/CEF mapping. The private relay
+  remains the transmission boundary; lifecycle observations alone do not prove
+  content inspection or universal realm coverage.

docs/electron-security-review.md

@@ -2,6 +2,12 @@
 
 This is a read-only review of the current source and unpacked Windows executable. It is not a penetration test or a claim of complete Chromium DLP coverage.
 
+Later entries record implementation and repeated native verification following
+this initial review. For current WebTransport per-attempt auditing and its
+coverage limits, use [native transport observability](native-transport-observability.md).
+Historical missing-event findings below have been superseded by that work;
+the separate native WebRTC engine crash remains an open acceptance gate.
+
 ## Official references
 
 Electron recommends isolated, sandboxed remote renderers, constrained IPC and navigation, current dependencies, and consideration of custom protocols and packaging fuses. [Security](https://www.electronjs.org/docs/latest/tutorial/security).
@@ -81,6 +87,15 @@ Inspection/inference runs outside the main process, but synchronous audit encryp
 
 ### Final package follow-up
 
+The subsequent shared clipboard/transport owner implementation also passed
+actual Windows package/runtime and fuse negative verifiers. Its enrolled native
+fixture now proves six Created and six Closed records, zero Established records,
+and twelve correlated lifecycle/audit traces. Clipboard/restart and actual local
+Gemma regressions passed with matching source hashes. This supersedes the
+transport audit-gap statements below for the specifically tested Window and
+dedicated Worker cases; it is not universal transport or payload coverage.
+See [native transport observation](native-transport-observability.md).
+
 The new frozen-source Windows build and both package verifiers passed after
 the startup correction. Actual baseline, RUN_AS_NODE, NODE_OPTIONS, CLI
 inspector, eleven certificate/feature override launches and copied-ASAR tampering

docs/local-dlp-relay.md

@@ -28,9 +28,12 @@ Native evidence: `artifacts/webtransport-native-proof.json`. The receiver got
 zero packets/bytes with the private relay while ordinary HTTP loaded. The
 Windows core DLP and real restart fixtures also passed with relay integration.
 Chromium upgrades must repeat this receiver proof; it is version-specific.
-WebTransport-specific denial audit events are not yet observed because the
-native rejection occurs before existing HTTP/relay callbacks. Do not claim
-complete transport-attempt SIEM coverage from the ordinary DLP event pipeline.
+The native rejection still occurs before HTTP/relay callbacks. A private native
+observer now supplies real lifecycle records for the tested Window/dedicated
+Worker paths through enrollment and policy changes. See
+[native transport observation](native-transport-observability.md). These are
+Created/Closed observations, not inspected-payload decisions or universal
+transport coverage. The relay remains the release boundary.
 
 Inspected WebSocket/WebRTC support remains the intended compatibility goal.
 Uninspected transports remain restricted until their content gates have their

docs/native-runtime/README.md

@@ -105,3 +105,80 @@ attempts; its tagged binder source lacks the no-op implementation. A later
 binary is acceptable only after source inclusion checks and all native gates
 above. Current ignored artifacts retain the original crashes and positive
 controls; an upgrade must not overwrite that evidence.
+
+## Local setup started, 2026-10-13
+
+An isolated checkout now exists at
+`C:/Users/karl/Safetynet/artifacts/native-build/electron44`.
+Electron tag44.7.0 resolved to commit
+`61f55c4ce540416b3e43f75f6c0f125d22e5e908`; its DEPS pins152.0.7977.130.
+The adjacent depot_tools checkout is pinned at
+`52ae103994896b9ce7742a605de8f43b410e5515`.
+The ignored `run-sync.mjs` wrapper supplies process-only PATH/toolchain/Git
+configuration and runs `gclient.bat sync --nohooks --shallow --jobs=2
+--revision=src@2c592105bbcd9490a9894df48d0fe59b2c512651`.
+It records `source-sync.log`, stops its own process tree if free disk falls below
+150GiB, and bounds each run to30minutes. A live bootstrap is not source completion.
+Current depot_tools expects `git.bat`; the first sync failed because only
+`git.exe` was installed. An isolated `artifacts/native-build/bin/git.bat` now
+forwards to the existing signed `C:/Program Files/Git/cmd/git.exe`; only the
+wrapper's PATH includes that shim. The initial Chromium clone observed after
+retry did not include a depth argument, so the requested shallow option must
+not be treated as proof of a shallow fetch. Disk/deadline bounds still apply.
+Hooks, patch application against Electron's full source, compilation and native
+acceptance remain pending.
+
+The controlled tagged bootstrap completed on2026-10-14 with exit0. Chromium
+`152.0.7977.130` resolved to
+`2c592105bbcd9490a9894df48d0fe59b2c512651`; Git reports a shallow repository.
+Electron's pinned nested checkout was preserved. The backport's `git apply
+--check` also passed against this **complete pristine Chromium checkout**.
+Electron's dependency synchronization and native patch hooks have not yet
+completed, so this does not replace the required check after Electron patches.
+The bootstrap wrapper is `artifacts/native-build/run-bootstrap.mjs`; its log is
+`bootstrap.log`. Initial fetch transferred a1.43GB pack; free disk after checkout
+was259.3GiB. No compiler or native test was executed at this milestone.
+
+The first dependency-sync attempt after bootstrap attempted a broad Chromium
+remote fetch because the DEPS revision was a textual tag. That owned process
+tree was explicitly stopped; its terminal exit was1. The matching local tag
+was installed and the wrapper now overrides `src` with the exact existing
+commit above, without modifying DEPS. The next run advanced into dependencies:
+Node's `v24.21.0` checkout completed at
+`955266bfdd854cd280dffd47548673914484e4c0`, followed by other Chromium
+dependencies. At this documentation snapshot the bounded dependency run is
+still active: dependency completion, patch hooks and compilation are **not
+verified**. Gclient initial dependency clones may still fetch full histories
+despite the shallow option; the disk floor and run deadline remain mandatory.
+
+The same dependency sync was subsequently stopped deliberately to free resources
+for failed application-test diagnosis. Its terminal exit was1; the owned process
+tree was verified and stopped, without starting another sync. Chromium, Electron
+and Node pins remain unchanged. Dawn, DevTools, ICU and Ink checkouts are present;
+V8 and WebRTC dependency checkouts are still absent. Free disk at this checkpoint
+was246.2GiB. This is a resumable preparation checkpoint, not a completed build.
+
+### Missing ATL/MFC: explicit administrator step
+
+Inspection found the existing installer at
+`C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe`, version
+4.10.30.62513. Its Authenticode status was **Valid**, signer Microsoft Corporation.
+Existing installation:
+`C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools`.
+The official required component ID is
+`Microsoft.VisualStudio.Component.VC.ATLMFC`.
+
+The current agent process is not elevated. No UAC bypass or installer launch was
+attempted. To install only this missing component, a user can run the following
+in an **administrator PowerShell** and allow the normal installer flow:
+
+```powershell
+& 'C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe' modify `
+  --installPath 'C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools' `
+  --add Microsoft.VisualStudio.Component.VC.ATLMFC --passive --norestart
+```
+
+Verify afterward using `vswhere.exe -products '*' -requires
+Microsoft.VisualStudio.Component.VC.ATLMFC -property installationPath`.
+Treat installer exit3010 as restart required; do not claim build readiness until
+the component is detected and toolchain checks pass.

docs/native-transport-observability.md

@@ -0,0 +1,76 @@
+# Native WebTransport security observation
+
+The private HTTP relay is the release boundary. Observation does not inspect
+WebTransport payloads and cannot replace native transport containment.
+
+Electron webRequest does not observe the tested Chromium WebTransport path.
+The browser now subscribes privately to native Created, Established and Closed
+events through the existing clipboard security owner's CDP connection.
+The [Electron debugger API](https://www.electronjs.org/docs/latest/api/debugger)
+and [Chromium Network protocol](https://chromedevtools.github.io/devtools-protocol/tot/Network/)
+describe this instrumentation. No debugger port or protocol dispatcher is
+exposed to websites, UI JavaScript or local agents.
+
+## Ownership and lifecycle
+
+The clipboard guard owns the only debugger attachment. Its fixed transport
+lease can enable network observation, attach related targets and resume startup
+targets; it cannot submit arbitrary commands or detach clipboard protection.
+Initial about:blank navigation completes before setup commands, which Chromium
+can otherwise defer indefinitely. Setup finishes before real page navigation.
+Worker observation is queued before startup resume, covering the tested worker's
+first statement. Disposal unsubscribes observation, resumes waiting targets and
+releases auto-attachment while preserving clipboard protection.
+
+Commands, targets, pending attempts and audit queues are bounded. Unexpected
+detach, command timeout, overflow or audit failure makes the browser remain
+quarantined until restart. Unexpected native establishment also quarantines
+synchronously in the native event handler, before entering the serialized audit
+queue. A held Created-audit regression verifies this ordering. This is a containment alarm;
+it is not proof that an observer could prevent already transmitted bytes.
+
+## Security records
+
+`transport.created`, `transport.closed` and `transport.established` carry an
+application-generated UUID, protocol, phase, realm, associated native tab UUID,
+connection-established flag and canonical destination hostname. Creation policy
+and owner context survive subsequent navigation or policy changes. Native CDP
+identifiers, URLs, query strings, initiators, certificates, headers and bodies
+are absent. Backend validation rejects contradictory phases, extra fields and
+noncanonical host data. Monitor failures accept only fixed reason identifiers.
+
+Records use the protected durable event pipeline. ECS and CEF preserve the
+lifecycle facts as observations with unknown outcome: a Closed event is not
+automatically claimed as an inspected or blocked payload. Operational traces
+use fixed browser.transport stages and correlate audit encryption, persistence
+and delivery without destination or content attributes. The signed diagnostics
+switch still controls operational exports independently of security auditing.
+
+## Actual Windows evidence
+
+The current shared-owner native fixture proves Window and first-statement
+dedicated Worker behavior through enrollment, reviewed DIRECT and fetched HTTPS
+PAC→DIRECT policies. The unguarded control delivered 132 bytes. Managed cases
+delivered zero packets or bytes, while three public HTTPS submissions worked.
+Six Created and six Closed records reached the central backend; none Established.
+All twelve exported phase traces have matching audit-stage parents. Ordinary
+webRequest callbacks remain zero, so these are actual native observations.
+
+Evidence: ignored `artifacts/fullmain-webtransport-native-proof.json`, source
+hashes and `artifacts/cdp-webtransport-native-proof.json`. The latter additionally
+checks real DevTools coexistence and verifies that observer disposal preserves
+clipboard ownership. Earlier literal/restart and real local Gemma regressions
+passed on the same source hashes. The later final-source literal/restart test
+also passes; the later semantic DLP checks pass but its debug acceptance records
+three export timeouts and one concurrency rejection. Those failures remain
+open and are separate from receiver containment. These scenarios do not prove every worker, iframe,
+shared-worker attribution or future Chromium transport implementation.
+
+## Measured limits
+
+During concurrent native source checkout/build work, semantic paste took
+2.9–3.7 seconds and public-file inspection 14.3 seconds. Protected audit fsync
+reached 414 ms. These traces identify work to profile; they do not isolate an
+observer regression or justify weakening scanning, isolation or persistence.
+The separate initial-about:blank WebRTC engine crash remains unresolved until a
+fixed native runtime is compiled and passes its paired receiver tests.

docs/requirements-audit.md

@@ -7,6 +7,18 @@ Die breiteren Anforderungen und Erweiterungen unten bleiben Roadmap.
 
 ## Aktuelle nächste Abnahmen
 
+**Aktualisierung des Windows-MVP:** 771 Tests bestehen mit begrenzter
+Parallelität. Der aktuelle Windows-Build besteht Paket-, Fuse- und
+Manipulationsprüfungen, ist aber nicht signiert. Native Clipboard-/Upload-Tests,
+Prozessneustart bestehen auf dem finalen Quellstand. Die lokalen semantischen
+Gemma-DLP-Prüfungen bestehen, ihre Debug-Abnahme scheitert noch an drei
+Export-Timeouts und einer Concurrency-Ablehnung. WebTransport-Versuche in Fenster und Dedicated Worker sind nun
+als korrelierte Security-Events und OpenTelemetry-Traces nachgewiesen; siehe
+[Transport-Nachweise](native-transport-observability.md). Der bekannte native
+WebRTC-Absturz bleibt offen, bis ein korrigiertes Binary geprüft ist.
+Die folgenden älteren Integrationszahlen beschreiben historische Zwischenstände;
+die aktuelle verbindliche Abnahme steht im [Windows-MVP-Ziel](windows-dlp-mvp.md).
+
 Aktueller Integrationsstand: 713 Tests bestehen
 (`artifacts/worker-integration-suite.log`). Der echte Admin-Workflow für typisierte
 Login-Regeln, unabhängige Veröffentlichung und Auditor-Leserechte ist geprüft:

docs/windows-dlp-mvp.md

@@ -48,8 +48,34 @@ erlaubte Ziele gelangen. Erst nach der folgenden Abnahme wird das MVP abgeschlos
 
 ## Aktueller Abnahmestand
 
-749 Tests bestehen im letzten vollständigen Lauf; ESLint verlangt null Fehler
-und null Warnungen. Nachweis: `artifacts/mvp-final-startup-suite.log`.
+**Letzter Quellstand:** Windows-Paket und beide Paketverifikationen bestehen;
+Authenticode bleibt `NotSigned`. Native Clipboard-/Upload- und echte Neustarttests
+bestehen erneut mit17+5 Prüfungen,13 öffentlichen Requests, null vertraulichen
+Requests und zwei exakt übertragenen Dateien. Aktuelle und lebenslange
+Exportfehler bleiben in diesen Prozessen0. Der frische öffentliche Diagnosetest
+mit vier geprüften Policy-Veröffentlichungen besteht ebenfalls.
+
+**Noch offen:** Die letzte echte lokale Gemma-Abnahme besteht alle vier
+DLP-/Empfängerprüfungen, scheitert aber an drei gemessenen2s-Export-Timeouts und
+einem `concurrency-limit`. Die neuen begrenzten Fehlerdaten belegen aktive
+Generation1 ohne Policy-Abbruch; sie beweisen noch nicht die Ursache der
+Antwortverzögerung. Kein Zähler wurde gelöscht oder eine Erwartung gelockert.
+Für die Debug-Abnahme sind begrenzte Export-Warteschlangen, ein gemeinsamer
+Flush und Latenz-/Eventloop-Nachweise zu prüfen. Ein weiterer geschützter
+Transporttest wurde nach diesem Fehler nicht einfach wiederholt.
+Der native WebRTC-Absturz bleibt ein separater offener Stabilitäts-Gate.
+Das MVP ist deshalb weiterhin **nicht abgeschlossen**.
+
+771 Tests bestehen im letzten vollständigen Lauf mit zwei parallelen Testdateien;
+ESLint verlangt null Fehler und null Warnungen. Nachweis:
+`artifacts/transport-owner-final-failure-ledger-suite.log`. Ein späterer
+Policy-Abbruch verlor ursprünglich seinen festen409-Fehler und lieferte500;
+dieser echte Gateway-Fehler ist mit deterministischen Tests und exportierten
+Traces behoben. Der stärker parallelisierte
+Lauf scheiterte an einer Evidence-Schlüssel-Rechteprüfung. Die kontrollierte
+ACL-Nachprüfung war geschützt; alle 18 Evidence-Tests bestanden anschließend
+separat. Die ursprüngliche Ausnahme enthält keine ausreichende Ursache, um
+einen Timeout rückwirkend als bewiesen zu behaupten. Kein Schutz wurde gelockert.
 Die neue native Windows-Abnahme besteht mit 17 Checks, einschließlich echtem
 Maus-Klick im contenteditable-Editor, Klartext/HTML-Clipboard, Policy-Race,
 YARA-/ICAP-Block und Scanner-Ausfall. Danach startete ein anderer Browserprozess
@@ -61,7 +87,11 @@ mit null Exportfehlern. Nachweise: `artifacts/windows-dlp-mvp-process-restart-su
 `windows-dlp-mvp-first-process-native-proof.json` und
 `windows-dlp-mvp-restart-native-proof.json`.
 Der aktuelle integrierte Relay-/Proxy-/Preload-Stand bestand diese native
-Abnahme erneut: `artifacts/windows-dlp-mvp-current-frozen-native.log`.
+Abnahme erneut. Der gemeinsame Clipboard-/Transport-Owner bestand danach
+wieder alle 17 plus fünf echten Neustart-Checks:
+`artifacts/transport-owner-mvp-native.log`. Auch die echte lokale Gemma-Abnahme
+bestand erneut: `artifacts/transport-owner-semantic-native.log`; Quellhashes
+blieben unverändert.
 
 Das Gateway prüft normalisierte Textdarstellungen einzeln und revalidiert
 Policy/Widerruf vor Versand und Ausgabe. Tatsächliche ICAP-/Provider-Tests
@@ -90,8 +120,13 @@ enrollte Browser übertrug null Pakete und Bytes, auch nach reviewed DIRECT und
 HTTPS-PAC→DIRECT-Policywechseln. Drei gewöhnliche HTTPS-POSTs funktionierten.
 Nachweis: `artifacts/fullmain-webtransport-native-proof.json`, mit genauen
 Quellhashes; spätere Änderungen betreffen ausschließlich Startparameterprüfung.
-Die vor HTTP blockierten Versuche liefern keine webRequest-Callbacks und
-damit weiterhin keine einzelnen DLP-Audit-Ereignisse. Diese SIEM-Grenze bleibt offen.
+Die vor HTTP blockierten Versuche liefern weiterhin keine webRequest-Callbacks.
+Der neue private native Observer erfasst jedoch tatsächlich sechs Created- und
+sechs Closed-Lebenszyklen mit korrelierten Traces und ECS-/CEF-Metadaten.
+Er teilt den begrenzten Kanal des Clipboard-Owners und trennt dessen Schutz
+nicht. Die Reichweite ist Window und getesteter Dedicated Worker, keine
+universelle Realm- oder Nutzlastprüfung. Details:
+[Native Transportbeobachtung](native-transport-observability.md).
 Ältere fehlgeschlagene Testläufe bleiben als solche erhalten.
 
 ## Verbleibende Abnahmen